Everything asked for, what is done, and what is blocking.
The working backlog. Updated as part of the work, like the changelog — if a task
is finished it moves to Done with what shipped, and if it is blocked the blocker
is named rather than left implied.
Preserve original Curlec payments and recover carts without bank-return cookies.
Secure EasyParcel OAuth with an admin session, single-use state and escaped HTML.
Keep the charged courier authoritative for booking.
Restore typecheck, lint and real root tests; add CI and remove ignored build errors.
Coordinate token refresh across clients/workers.
Make fitment and return-request retries safe.
Update documentation and pass backend, storefront and docs builds.
Supply real stock counts, confirm pre-order rules and verify suspect weights.
Rehearse payment, shipment and refund flows in configured test accounts.
Deploy and verify the live connection and bank round trip.
Validation: 27 tests pass; typecheck passes; lint has no errors and retains
43 backend / 31 storefront warnings for follow-up. These fixes are local; this
is not confirmation of a live deployment. Engineering checklist:
docs/audit-todo-2026-09-06.md.
Two things block launch: no real payment has ever completed, and the apex
domain still points at Shopify.
DNS, routing, port and target all verified correct; Railway will not issue. Needs a support ticket. Admin works at api.autoxspare.com/app.
6
EasyParcel Open API module
Blocked
Confirmed: the account is on the Open API (REST + OAuth2), not the Individual API the old client targets. New client written; needs client_secret and a one-time browser authorisation.
7
End-to-end test — admin side
Partly done
Customer journey done to the payment step. Admin scenarios (fulfilment, refund, draft order) not yet walked.
Done — admin → Payments. Captured, fees, refunds, recent payments and settlements, read from the gateway.
9
Live View (visitors, sessions, conversion)
Needs a web-analytics provider — order data cannot produce sessions. See Analytics.
10
Vehicle admin form
CRUD already exists at Settings → Product Tags; what is missing is a form that fills kind/brand/model/year_from/year_to correctly instead of hand-edited metadata.
11
Membership
The product page already shows a "Monthly Membership" price. Tiers, signup and renewal do not exist. Needs scoping before building.
Medusa version — already on 2.19.0, which is the latest published.
Collections / categories / tags / customer groups CRUD — all ship natively.
Collections and Categories sit under Products in the sidebar; Product Tags and
Types under Settings.
Is the vehicle filter dynamic? — yes. Vehicles are product tags read at
request time, so adding one in the admin appears on the storefront with no
deploy.
The Curlec module — its return/session bugs were repaired in the September 6
audit fixes above. Provider methods and mocked regression checks are complete;
deployment and an end-to-end payment rehearsal remain open.
Why Curlec has no sidebar entry — a payment provider is not an admin page
in Medusa; it surfaces under Settings and on each order. The new Payments
page fills that gap.